#126599 - 2004-09-12 07:04 PM
Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
Hi,
We have recently migrated to 2003 AD from NT4.0 domain. I'm having no luck running any ldap script from my NT4.0 workstation (with ADSI installed) or from W2K or even from W2K3 server, however, the script runns OK on the AD DC server.
Moreover, Chris's Active Directory browser runs only from the AD DC and will not run from the above mentioned stations (NT4.0 W2K and W2K3).
Can someone please explain what could be the problem??.
Note: I connect with a domain administrator account from all locations.
Thanks
Sami
|
|
Top
|
|
|
|
|
#126601 - 2004-09-13 07:46 AM
Re: Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
Les,
Thanks for the reply, the DC is part of our company's global domain (which I realy don't have much control over). However, is there a way I can force my scripts to querey my DC instead of trying to query the GC (if this is really the problem)?.
Thanks
|
|
Top
|
|
|
|
|
#126603 - 2004-09-13 08:58 AM
Re: Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
I should have mentioned that my login script works OK on all my clients, however, I don't have any ldap qurey in my login script.
Rgds
|
|
Top
|
|
|
|
|
#126604 - 2004-09-13 01:12 PM
Re: Active Directory and LDAP
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Quote:
Note: I connect with a domain administrator account from all locations.
Does this mean that you can LDAP query using a domain admin account?
Can you post a simple LDAP call you have tried?
|
|
Top
|
|
|
|
|
#126605 - 2004-09-13 02:11 PM
Re: Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
Hi,
This is a the code I'm trying to use:
Code:
$strUserName = "username"
$group = "groupname" ; The group you are trying to connect to
;
$ldapuser= "ou=xxx,ou=yyy,ou=hhhh,dc=dddd,dc=ff,dc=kkkk,dc=com"
$adsUser = GetObject("LDAP://cn="+$strUserName+","+$ldapuser,1)
;
$ldapgroup = "ou=xxx,ou=yyy,ou=hhhh,dc=dddd,dc=ff,dc=kkkk,dc=com"
$adsGroup = GetObject("LDAP://cn="+$group+","+$ldapgroup) ; Connects to the ldap path of the group
;
If @Error <> 0
$null = messagebox(@SError,@Error,0)
Else
$null=messagebox($adsGroup.name,"Success",0)
Endif
$adsGroup.add($adsUser.ADsPath)
|
|
Top
|
|
|
|
|
#126607 - 2004-09-13 10:10 PM
Re: Active Directory and LDAP
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Add some direction for the bind to your LDAP string. After LDAP:// you can place the domain or DC name. See the example below and let us know the result.
$adsGroup = GetObject("LDAP://@Ldomain/cn="+$group+","+$ldapgroup)
Edited by Howard Bullock (2004-09-13 10:10 PM)
|
|
Top
|
|
|
|
|
#126608 - 2004-09-14 07:28 AM
Re: Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
Howard,
I have put the @ldomain reference as suggested and I'm getting an error message "The server is not operational".
TKS
|
|
Top
|
|
|
|
|
#126609 - 2004-09-14 07:01 PM
Re: Active Directory and LDAP
|
Howard Bullock
KiX Supporter
Registered: 2000-09-15
Posts: 5809
Loc: Harrisburg, PA USA
|
Interesting. Will have to research that one.
|
|
Top
|
|
|
|
#126610 - 2004-09-15 01:20 PM
Re: Active Directory and LDAP
|
LASAD
Getting the hang of it
Registered: 2001-10-02
Posts: 60
|
OK..In my hunt to resolve this issue I came a cross this Windows Active directory tool to manage users "Ldifde.exe" which I tried to use and to my surprise did not work and the error message was: "No DC available". However, I successfully ran a VBS script (using WinNT provider)from the same PC (w2k) and I was able to add one user to a group.
So I came to a conclution that using LDAP provider my scripts will not work, however they will work if I use WinNT provider.
Maybe I should have mentioned the fact that our local resource domain is still NT4.0 however our global accounts domain is AD (with a local DC at our site).
To add more to this, someone from our AD team has directed me to make the following registry change from where I will run my admin scripts:
HKLM\SYSTEM\CurrentControlset\services\netlogon\parameters. and add the follwoing Reg_dword "NeutralizeNT4Emulator" with value 1. But that did not help.
Does that make any sense...
|
|
Top
|
|
|
|
|
#126611 - 2004-09-15 06:49 PM
Re: Active Directory and LDAP
|
NTDOC
Administrator
Registered: 2000-07-28
Posts: 11634
Loc: Space
|
Doesn't make sense to me.
How to prevent overloading on the first domain controller during domain upgrade
http://support.microsoft.com/?id=298713
How can I configure Windows NT 4.0 emulation on my Windows Server 2003 or Windows 2000 Service Pack 2 (SP2) domain controllers (DCs)?
http://www.winnetmag.com/Article/ArticleID/42034/42034.html
Think you need to do some in depth NSLOOKUP work and/or some sniffing of the network. Also NLTEST may help in diagnosing this problem.
Something is preventing you from talking to the AD which needs to be corrected before any scripts are going to run on the AD for you.
|
|
Top
|
|
|
|
Moderator: Shawn, ShaneEP, Ruud van Velsen, Arend_, Jochen, Radimus, Glenn Barnas, Allen, Mart
|
0 registered
and 2220 anonymous users online.
|
|
|
